CVEs published July 22, 2026
199 CVEs were published on July 22, 2026: 19 critical, 100 high. 1 is now in CISA KEV.
- Published
- 199
- Critical
- 19
- High
- 100
- Medium
- 71
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 119
Most affected products
- MongoDB Server
- 25
- NLnet Labs Unbound
- 24
- n8n-io n8n · n8n
- 14
- Progress Software Telerik UI for ASP.NET AJAX
- 13
- Oracle Platform Security for Java
- 11
- ISC BIND
- 9
- Dell PowerProtect Data Manager
- 6
- FFmpeg
- 6
- Red Hat Ansible Automation Platform
- 6
- Hikvision DS-2CD Series · Hikvision DS-2DE Series
- 3
Critical 19
- CVE-2026-60372Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60369Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60367Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60366Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-64793Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensionsregularlabs.com Articles Anywhere extension for Joomla · re…
- CVE-2026-64796Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extensionregularlabs.com Sourcerer extension for Joomla
- CVE-2026-64798Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extensionregularlabs.com IP Login extension for Joomla
- CVE-2026-64829Question2Answer 1.8.8 Session Fixation via Forgot-Password Flowq2a question2answer
- CVE-2026-13072MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionMongoDB Server
- CVE-2026-16624CVE-2026-16624Cal.com Cal.diy
- CVE-2026-46738Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API.Dell PowerProtect Data Manager
- CVE-2026-40712Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API.Dell PowerProtect Data Manager
- CVE-2026-16606Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle SolarisFujitsu Linux openFT · Fujitsu Oracle Solaris openFT
- CVE-2026-2395SQLi in Xpoda Türkiye Informatics Technology's No Code PlatformXpoda Türkiye Informatics Technology No Code Platform
- CVE-2026-62144Management Authentication Bypass and Privilege Escalationcheckpoint Quantum Security Management · checkpoint Multi-D…
- CVE-2026-16232Authentication Bypass in the SmartConsole Login Process Using an Application Tokencheckpoint Quantum Security Management · checkpoint Multi-D…
- CVE-2026-8152Unblu Spark Open Redirect leading to DOM-Based XSSUnblu Spark
- CVE-2026-63048Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2joomlack.fr Page Builder CK extension for Joomla
- CVE-2025-50329An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code v
High 100
- CVE-2026-61246Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60455Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60439Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60373Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60371Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60370Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-60368Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).Oracle Platform Security for Java
- CVE-2026-64797Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extensionregularlabs.com IP Login extension for Joomla
- CVE-2026-63265Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpointsregularlabs.com Advanced Module Manager extension for J… +21
- CVE-2026-63685Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extensionregularlabs.com DB Replacer extension for Joomla
- CVE-2026-63280Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions managerregularlabs.com Advanced Module Manager extension for Jo… +2
- CVE-2026-63683Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions managerregularlabs.com Advanced Module Manager extension for Jo… +2
- CVE-2026-64792Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensionsregularlabs.com Articles Anywhere extension for Joomla ·… +5
- CVE-2026-64791Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Managerregularlabs.com Regular Labs Extension Manager extension fo…
- CVE-2026-63684Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extensionregularlabs.com Content Templater extension for Joomla ·… +1
- CVE-2026-13089OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verifyRITOU OIDC::Lite
- CVE-2026-14881Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flowMongoDB Compass
- CVE-2026-13055Server crash via aggregation pipeline expression with compound wildcard index specificationMongoDB Server
- CVE-2026-13056A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAMMongoDB Server
- CVE-2026-13058Transaction Command Insufficient Input Validation Leading to Process TerminationMongoDB Server
- CVE-2026-13059Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassMongoDB Server
- CVE-2026-9737Find command with $meta sort can lead to crashMongoDB Server
- CVE-2026-13060$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection AccessMongoDB Server
- CVE-2026-14899Off-by-one out of bounds read in MIME header parser for forwardingMozilla Thunderbird
- CVE-2026-13062MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded ClustersMongoDB Server
- CVE-2026-13064MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of ServiceMongoDB Server
- CVE-2026-13065MongoDB $linearFill Window Function Improper Input Validation Leading to Process TerminationMongoDB Server
- CVE-2026-13066Server-Side JavaScript DBPointer BSON Serialization Memory DisclosureMongoDB Server
- CVE-2026-13067tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain SocketMongoDB Server
- CVE-2026-13069Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource ExhaustionMongoDB Server
- CVE-2026-13071Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process TerminationMongoDB Server
- CVE-2026-13075$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion GenerationMongoDB Server
- CVE-2026-13076Aggregation Framework Memory Exhaustion Leading to Process TerminationMongoDB Server
- CVE-2026-13077Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn DataMongoDB Server
- CVE-2026-22049ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to thNETAPP ONTAP
- CVE-2026-16157Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerabilityDuplicati
- CVE-2026-64835FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio DecoderFFmpeg
- CVE-2026-64834FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerFFmpeg
- CVE-2026-64833FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.cFFmpeg
- CVE-2026-64832FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.cFFmpeg
- CVE-2026-64831FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC DecoderFFmpeg
- CVE-2026-64830FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerFFmpeg
- CVE-2026-65013Onlook tRPC Insecure Direct Object Reference via multiple proceduresonlook repo
- CVE-2026-49499Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM.Dell PowerProtect Data Manager
- CVE-2026-40714Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability.Dell PowerProtect Data Manager
- CVE-2026-16607Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle SolarisFujitsu Linux openFT · Fujitsu Oracle Solaris openFT
- CVE-2026-14985CVE-2026-14985Analog Way Picturall Quad Compact Mark II
- CVE-2026-13321DNSSEC Validation Bypass via Out-of-Zone NSEC Next FieldISC BIND
- CVE-2026-13204Unexpected exit in certain situations with NSEC and NSEC3 both presentISC BIND
- CVE-2026-12617Record ordering based unexpected exit with CNAME or DNAMEISC BIND
- CVE-2026-48029libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflowstrukturag libheif
- CVE-2026-11721Cache poisoning possible with label count discrepancy, RRSIG, and wildcardsISC BIND
- CVE-2026-11622Potential memory usage beyond configured limitsISC BIND
- CVE-2026-11605Unnecessary validation of DNSSEC signed recordsISC BIND
- CVE-2026-11331Potential wildcard CNAME RPZ policy bypassISC BIND
- CVE-2026-62145Local Privilege Escalation in Gaia Portalcheckpoint Quantum Security Gateway · checkpoint Quantum Se…
- CVE-2026-13190PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13189SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13187DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13186AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13185PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13184RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13183RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13182RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13181RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-55973'dns-error-reporting: yes' leads to stack buffer overflowNLnet Labs Unbound
- CVE-2026-44690Cross-zone wildcard cache poisoning via RRSIG.labels manipulationNLnet Labs Unbound
- CVE-2026-40691Packet of death for DNSCrypt over TCPNLnet Labs Unbound
- CVE-2026-32665Remote DNS-over-QUIC denial of service due to `quic-size` budget bypassNLnet Labs Unbound
- CVE-2026-44191Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settingsRed Hat Ansible Automation Platform
- CVE-2026-4773OTP Bypass in Magarsus' IDM-MFAMagarsus Consulting Ltd. IDM-MFA
- CVE-2026-44190Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script settingRed Hat Ansible Automation Platform
- CVE-2026-44189Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenameRed Hat Ansible Automation Platform
- CVE-2026-65603Grav Login Plugin 3.8.11 Privilege Escalation via Profile Updategetgrav grav
- CVE-2026-65600Traefik before v2.11.52 Authentication Bypass via ReplacePathRegextraefik · github.com/traefik/traefik/v2 +2
- CVE-2026-65598n8n before 1.123.64 Remote Code Execution via Git Clonen8n-io n8n · n8n
- CVE-2026-65597n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframen8n-io n8n · n8n
- CVE-2026-65595n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchangen8n-io n8n · n8n
- CVE-2026-65592n8n before 1.123.64 Stored DOM XSS via cachedResultUrln8n-io n8n · n8n
- CVE-2026-65591n8n before 1.123.64 Sanitizer Bypass Remote Code Executionn8n-io n8n · n8n
- CVE-2026-65016n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Rolen8n-io n8n · n8n
- CVE-2026-65015n8n before 2.30.1 Privilege Escalation via run_node_tooln8n-io n8n · n8n
- CVE-2026-61391There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfHikvision DS-2CD Series · Hikvision DS-2DE Series
- CVE-2026-61390There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunctiHikvision DS-2CD Series · Hikvision DS-2DE Series
- CVE-2026-57600Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sHikvision DS-2CD Series · Hikvision DS-2DE Series +2
- CVE-2026-14551Local Privilege Escalation in servereye client (sensorhub)servereye Windows Agent
- CVE-2026-63047Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1joomdonation.com Events Booking extension for Joomla
- CVE-2026-3821Supermicro SMASH service contain an Arbitrary code execution issueSMCI X14DBG-DAP,X14DBI
- CVE-2026-12987Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEvents Manager
- CVE-2026-12968Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG UploadProduct Addons and Product Options With Custom Fields
- CVE-2026-15802WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX ActionChimpstudio WP Foodbakery
- CVE-2026-56844A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges andVeeam Backup and Replication
- CVE-2025-44089An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
- CVE-2025-44090An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
- CVE-2025-50324An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.
- CVE-2025-50327An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a byp
- CVE-2025-50330An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via
- CVE-2025-60835An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.
- CVE-2026-38765An issue in Unistal Systems Pvt.
- CVE-2026-38766An issue in Unistal Systems Pvt.
Medium, low and unrated 80
- CVE-2026-16632boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validationboazsegev facil.io
- CVE-2026-16631publint package-manager pack.js child_process.exec os command injectionpublint
- CVE-2026-16630syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injectionsyncfusion ej2-javascript-ui-controls
- CVE-2026-16629danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injectiondanger-js · danger
- CVE-2026-16628oclif JIT Plugin Entry child_process.exec os command injectionoclif
- CVE-2026-64794Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensionsregularlabs.com Articles Anywhere extension for Joomla · re…
- CVE-2026-64795Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensionsregularlabs.com Modals extension for Joomla · regularlab… +3
- CVE-2026-63281Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions managerregularlabs.com Advanced Module Manager extension for Jo… +2
- CVE-2026-13057Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_METAMongoDB Server
- CVE-2026-13061Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation StageMongoDB Server
- CVE-2026-13063libmongocrypt Improper Input Validation Leading to Process TerminationMongoDB Server
- CVE-2026-13068MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege MisuseMongoDB Server
- CVE-2026-13070Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process TerminationMongoDB Server
- CVE-2026-13073MongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationMongoDB Server
- CVE-2026-13074Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of ServiceMongoDB Server
- CVE-2026-13078Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module LoaderMongoDB Server
- CVE-2026-3482IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization BypassIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-65650Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.Elgg
- CVE-2026-7328Unverified AXI Address in Subsystem Mode Commands Enables Denial of ServiceCaliptra Core Runtime Firmware
- CVE-2026-65012InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folderinvoke-ai InvokeAI
- CVE-2026-65011Graylog2 Server Missing Permission Check on Event Definition Duplicategraylog2-server
- CVE-2026-16615Librest: weak random number generation in pkce implementationGNOME librest · Red Hat Enterprise Linux
- CVE-2026-46737Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API.Dell PowerProtect Data Manager
- CVE-2026-64828Froiden TableTrack 1.3.10 Stored XSS via Order Notes FieldFroiden TableTrack
- CVE-2026-44276Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulneraDell PowerProtect Data Manager
- CVE-2026-10822Key Record using PRIVATEDNS algorithm may lead to unexpected exitISC BIND
- CVE-2026-10723Incorrect acceptance of NSEC3 recordsISC BIND
- CVE-2026-14932Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChartProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-14865XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-13192RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-53910Heap-based Buffer Overflow in GNU diffutilsGNU diffutils
- CVE-2026-13188DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAXProgress Software Telerik UI for ASP.NET AJAX
- CVE-2026-56444Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configurationNLnet Labs Unbound
- CVE-2026-56416Possible heap buffer overflow when validator canonicalizes RDATA that contains domain nameNLnet Labs Unbound
- CVE-2026-55991Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2NLnet Labs Unbound
- CVE-2026-55990Packet of death for a DNSCrypt misconfigured UnboundNLnet Labs Unbound
- CVE-2026-55717'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crashNLnet Labs Unbound
- CVE-2026-55708Privacy/configuration issue when adding local data in views through 'unbound-control'NLnet Labs Unbound
- CVE-2026-54478DNS Cookie bypass when combined with proxy-protocol useNLnet Labs Unbound
- CVE-2026-52863Memory corruption could lead to crash and denial of serviceNLnet Labs Unbound
- CVE-2026-50252Possible cache poisoning attack by mapping source port population per threadNLnet Labs Unbound
- CVE-2026-50251Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flushNLnet Labs Unbound
- CVE-2026-50248BOGUS configured primary hostname accepted for XFR in auth/rpz zonesNLnet Labs Unbound
- CVE-2026-50243'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAILNLnet Labs Unbound
- CVE-2026-50046Possible heap use-after-free in an error path when a DoT forwarded query is jostled outNLnet Labs Unbound
- CVE-2026-50045'max-global-quota' reset by DNSSEC validation restartsNLnet Labs Unbound
- CVE-2026-46582A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply pathNLnet Labs Unbound
- CVE-2026-44687Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAINNLnet Labs Unbound
- CVE-2026-44621Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminatedNLnet Labs Unbound
- CVE-2026-42955Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue recordsNLnet Labs Unbound
- CVE-2026-41637Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queriesNLnet Labs Unbound
- CVE-2026-14586Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environmentsNLnet Labs Unbound
- CVE-2026-16560389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdnRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-16270ReDoS in Open MercatoOpen Mercato
- CVE-2026-44187Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api keyRed Hat Ansible Automation Platform
- CVE-2026-44192Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversalRed Hat Ansible Automation Platform
- CVE-2025-13146Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Executionsevenspark DTX – Dynamic Text Extension for Contact Form
- CVE-2026-16551Denial-of-Service in OpenCanary's MongoDB moduleThinkst Applied Research OpenCanary
- CVE-2026-65602Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypasstraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-65601Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionReftraefik · github.com/traefik/traefik
- CVE-2026-65599n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Headern8n-io n8n · n8n
- CVE-2026-65596n8n before 1.123.64 Credential Exfiltration via GraphQL Noden8n-io n8n · n8n
- CVE-2026-65594n8n before 2.30.1 Missing OAuth Authorization Checkn8n-io n8n · n8n
- CVE-2026-65593n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parametersn8n-io n8n · n8n
- CVE-2026-65590n8n before 2.30.1 Shell Sandbox Bypass on Linux Windowsn8n-io n8n · n8n
- CVE-2026-65589n8n before 1.123.64 Credential Exposure via LLM Node Execution Datan8n-io n8n · n8n
- CVE-2026-65014n8n before 2.28.0 Authentication Bypass via test-webhookn8n-io n8n · n8n
- CVE-2026-16544Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosureRed Hat Ansible Automation Platform
- CVE-2026-61392There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information Hikvision DS-2CD Series · Hikvision DS-2DE Series
- CVE-2026-57599There is a privilege escalation vulnerability in some Hikvision cameras.Hikvision DS-2CD Series
- CVE-2026-16473Sbc: sbc: heap out-of-bounds read via crafted sbc audio frameRed Hat Enterprise Linux
- CVE-2026-2406IDOR in Universe Software's Online Registration and Workflow Management SystemUniverse Software Computer Marketing Trade and Industry Onl…
- CVE-2026-15787Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributesbrainstormforce Ultimate Addons for Elementor
- CVE-2026-63264Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3joomshopping.com JoomShopping extension for Joomla
- CVE-2026-45820fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync().101arrowz fflate · fflate
- CVE-2026-14322Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_methodTimetics
- CVE-2026-16492umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injectionumijs umi
- CVE-2026-16490itsourcecode Hospital Management System prescription.php sql injectionitsourcecode Hospital Management System
- CVE-2025-50325BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability.
- CVE-2026-38763An issue in Unistal Systems Pvt.